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Abstract not available for JP2000516733T 
Abstract of corresponding document: WO9808323 
This public-key cryptosystem endocing technique 
uses a mixing system based on polynomial 
algebra and recuction modulo two numbers while 
the decoding technique uses an unmixing system 
whose validity depends on elementary probability 
theory. A method for encoding and decoding a 
digital message comprises the steps: selecting 
ideals p and q of a ring R (305); generating 
elements f and g of the ring R (325), and 
generating an element F sub q which is an 
inverse of f (mod q), and generating F sub p 
which is an inverse of f (mod p) (340); producing 
a public key that includes h (350), where h is 
congruent, mod q, to a product that can be 
derived using g and F sub q; producing a private 
key from which f and F sub p can be derived; 
producing an encoded message by encoding the 
message using the public key and a random 
element; and producing a decoded message by 
decoding the encoded message using the private 
key. 
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(54) K^O)*^ &»*lfr^*^A^ifci3.£tf£« 



(57) mm: 

<t«a£IjRt4Xfs/^ (3 0 5) <k, mRV>&&f 
fe«fctfg«:£j&f SX^y:/ (3 2 5) t, F sub 

a. -r^fc-fe, f (mod a) ©aasc^^-r*;* 

T«/7±, F sub p, ffcrfc^f (mod p) 
<OM».&§iltttZ7.7-y7 (34 0) <h» g*«fc^F 
sub q&^LT3»m-r*;:t<D-r€f-5Slt» a* 

(3 5 0) f43«fctfF sub p&miti-rZZt 



N. p. 4» 



3^5 *>fi»8« 



h= F« (mod q) 
tLTgfWT* 



f II f . F, •«!»«-» 



SIR OS* f jsitfgSr^tU f (mod q) <Oig«rC*>S£*Fq «:£ 
JSfeU. f (mod p) ©«fe5IiFp^t5^ry/^ 

2 . mmR&mz&m ? ^ihz - 1 ^mt-r ^n^mmm 1 « 

3. Z^l5R(7)WN-efc^ 1 J; •9^'#/«cS»:-efcSn £:£:#^-r 

4. gtRtfS. #3£©#^S:fei:i-S^«*©8l^*>S-i:S:#tRi:-f5»*«) 

5. ^^^-r^tufE^^^^^^ ^> g (mod q) 
8CT?S>5g*Gq«:£/£U g (mod p) «tfc5giG P ^W5^ 

g^gi (i=l. 2 K) Sr£3^ S(HE^M«h36Shi (i=l, 2 K 

8. mmy^yj^mm<t>^^^'r^p (i = i. 2 k) tu 



(3) ^2 0 0 0-5 1 6 7 3 3 




4> 1 *h 1 4-m (mod a ) 



vmmm i ^iEf^&o 

1 0. StiE-fxT^p i:q»^[:^Itiao-C4^$ti5wi?:^t 

Fq* f = 1 (mod q) 
Fp* f = 1 (mod p) 

h = Fq* g (mod q) 
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4 , 

(4) 

15. HijfS^^t:^ y-fe-^e 

e = p4>*h+m (mod q) 

1 6. HfjfHm#^ yfe— 
, a = f * e (mod q) 

m' =Fp*a (mod p) 

17. ^ESf *5«fctJ s g*^J*-*"^lB^7 l S'^^ lE^SfcK^WlU Kii 

£>#JSl5£g&gi, g2 gk £ LtWS^rj'^t^ S&fB4*M*tf s h 

1, h2 hk£^^ 

hi=F q *gi (mod q) , i = l, 2 K 

18. jfriaRF-iHfc;^ ^ir-v^e 

e s p 0i * hi + p 02* h2 + . • - + P <*>K* hK +m (mod q) 

02 0 K tf*K^9:/^#^^fc5-£&#l*£^5i*#^ 

19. frSE^fk^ yi?— -s^* 5 . s>53-— if^«torfcs#0f"t?^$ti/, stria 
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4 . ■ 

(5) 2000-516733 

2 0. *= y *^gs£M (x) ^m^mmK ^-r^^mn 

<omn&m\ &^-c&£&m (x) pj^^ftsr^-rsr tiaot 

21. #M?n<0fif#N#»#£*i, ^i^HHI^ N^&ir-f-5^^S^-r 
2 2. HfrfE^st f , g. m, * ^f^t^ to i 9 I^J^l^tiS 1 1 5r#t 
2 3. MfSSSfcq^S, HUlSS^P £ r BfTlS#^ f , g, m, ffjfE 

2 4. fufESgfrq;^ fftf2»tpi:> itufE^^ f , g, m, tulE 
Sw«t^#^i-f- S ff^:(D^ia^2 2*1 

woo (mod P ). (i = 1, 2,...,K)vfoznm<Dm 

^?>K+2f©fifjfijf , g, gi, w2 wKlr^tS^rs'^i, 

S&IE^JcD^^^t^JFp, Fq, G P , Gq^t5^fS'7 p tfcot, 
f Fp = I (mod p) 
f Fq= I (mod q ) 
g Gp= I (mod p ) 
g Gq = I (m o d q ) 
-hit-? I ^^fifr^J-e £> -5 ^ ^ 3> ^ t , 
^8fl*£KfB©?T?'J (hi, h2 hk) <D V * h t LT^tS y 

hiSF,wiGq (mod q), i = l, 2 K; 



4» 

(6) 2000-516733 

wmm&nm u, g, f Pj g p ) tu^ts^fy^^ 

e = ^)i hi + ^2 h2+. .. + <f>KhK+m (mod q) ; 
a = feg (mod q ) 

b = a (mod p ) 

m ' = Fp b Gp (m o d p ) 

2 6. ff||5^^^ yfe — h&^—*f\<l£oXfoZ>i£tfTX*{kj&£th, fufE 

2 7. fiJfE^f Mwi , w2 wk, f, g, m^f#itS:toi 5 l-^J^^tT, 

2 8. 9ffSEfiE*q*S, ffufSSifep^ Str.fE«E&K£, StflE^^wi , w2 

wk, f, g, mC0<^ifc£, fUjsE^iS^wi , w2 wk, f, g, mCD&m^ 

2 9. B&IBSEafcqtfS, fuiE«ifcp<^ fflr3SSE#K£, huIS^^wi, w2 

wk, f, g, mfD^kmt, ftjfS^Ig^wi , W2, . . . , wk, f, g, m<0%&L\Z. 

tt-tzMmmmb, mm<t>r> <t>z *K^*n-5Swafw*&^^«to'rft*5* 



(7) 2000-516733 

-Y 77^ p *3 J: q 

ItRcog^ f *5«fctfg ££/£U f (mod q) ©ifflfifc-efc5K*Fq«:£ 

f (mod p) <0&#-C*>ail*Fp££j*-*-£#a^ 
gfc J:t;Fq ^ 5lt m o d qt^tfc^h^ 

f *3 i ot f P 6 r i © -e # 5 ^fflfii* ^fife-T 5 £ . 
3 1. mmft^-ik* ^-ir-v^. &5^-if^J;oTfe5#Bfr?£/&£*U huIB 

3 2. aft ^^^A^^-ifT^-e'l-f^^iiit-rs^-efcox, 

;\sQ(DmWtb LTf R4 3 ^>^< th lo0>4*0MO?*hi hk3r£j&-r& 

SRi, ^f7;PQt, ^fT/VPi, R^^Shi h k £ <Df£i£ S:^ 
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e, fi fn(DiiF^lit5R^^AS:f+m ft*JMsfc*CQ© 

£^*<0A<0ft*3Mjfc3Ra fcft^U a, fi f n ^BBfftGSrM-TSte* 

BfcfUfU f-t^J^mCpcDft^^WBOf^pJ^^b^imb, b, fi 

f n ©BB*H*ffflffi-Sf^*3WJfe*Gp ©*S* c 5 Z.b\^£^X 

34. a, b, c, fi f n»StrsfIt?): tlUot, 11^- F 

3 5. 4&Mft£#hi hk^, 1 k©MO# i i:ov^8#f i i^fT/i' 

Q£}£<h LTRK'thi f k + i b&W\X*hZ>b\^o 

3 6. fi fk + i#\ Sifi fkiWf7/>P^5H^ 

3 7. *ffl7^A5#0i 0 1 tufTW? \z.tb*z. t&ufcmt-i-zn 

C> ^(ommw, 3 2 gucfsgccD^fSfeo 

38. ^ffln^hi hk£, mm^^y^mt^ mm*y 

±-i?mmmb<Dmmb^x*£!&£tiz>mmei)K ^tt^q^^ tt^hi 

+ 02h2+ + <J>k hk + tf>k +mt-g-|I|-efeS Co^lf £ Lt^fiJc^iiSr 

3 9. e, fi f n^W^F^fW-rS^Atf^e f kntfe^: b^Wtik 

b-tzm#<Dm,mm3 2m^mm^^m 0 

40. a, fi i n <D§B§fcG&WM-tZ>&%:B-t>mmaX'ibZ>Z.b&¥F&k 

4 1. a, fi f nCDlS^H^iWt'Sf^PJ^^Cp^^O^^c 

-8- 
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4 3. SSRtfS, ftjBfeN<0*=S'^#^^:M (X) iaoT4^^6R^f7 

3 2«^|5«©^fe 0 

4 4. ^ffl#Mffi fn, RfWfi^yt-^im, *3JUPM7^ 

4 6. SKShi hk^\ 1 iK(Df B 1©#iHo^Tgifk + i hi fk + 2^Mf 

4 7. *ffl«S*f 1 . . . f k^f7/i/ptfl:fe5r ^:o«fi 
H^3 2^^|E*fe©^^ 0 

4 8. fl7vng5f?0i *2k*iis, ^^01 ^k^/ffT^P^i: 

4 9. temmmmh) hk ^-m^^^^mm^^ <*>2k+i t, m-m* 

hi 0k + i+<^2h2^k + 2+ +<|)khk 02k + <i)2k + i +mi:^'Pfe5CoOi 

-9- 



4 

(10) 4#^2 000-516733 

p -cfij t> -ejtLSi-^T (Dffmfrb ft 5 -r tt;k^ t» , f«fj^ co ©^a* 

5 1. fi fn, yfe— ^5l*m, *5<trj?#ffl7^^^^ 

5 2 . mm? <*> 1 * 1 ^ 1 *i &wsLnw<ofe&tire 

«f 3 2 5[^SBjR<0^jSfeo 

54. 4M3flt££Rfi f n , fffl^yt-^gim, j3±t;*ffl5^8 

55. gjtR^ - sg |^ X N=l. Y2 = i, XY = YXN-'i:^^i^i: 

qtioT^$tl5Yf7/^^^ R^^VP^ItpCiot^^ 
^l5^77;K'fe^ ft**Jsfe5RCo^*^s, &$fetfSii:Vvtf^N- 1 T q Srfe 
i^5^f)J^^^^^^ig^tL/^^^^Wi-5^mx^^(t6R^O#^ 
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(11) 1#«2 0 0 0- 5 1 6 7 3 3 

5 6. *ffl«S*f i,.... f n, «^ y-fe— ^Mm, *3 J: tf^ffl 7 



(12) ¥f%2 000-516733 

*mmi*. 1 9 9 e¥8^ 1 9 B\z.mmztittxmGWf&tomm6 o/o 2 4 
Mm^Mm^hv. n>^4tn\z-&±-?*>*i>K 2o«aw«mic 
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7 i/l^tUft:, ^^io-Cfi^m^iJI^^m^t^^^-CV^^o b 
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(14) 000-516733 

<Dm\*4 ooooo \fy hms<^*£&^tT?ij-efc5o rtu£:*:gi$#£>j£ffl# 

Tl^ftV\ 

* h/KO^:t**^^e>ta^f^ife^3B^-rsr tSrRTIiBtciU MJft 

fcf, -fe^jjy^ . ^/^fi, Steffi £*i/ri> -5 



(15) #gt 2000-516733 

f (mod q) ■ <7>5g#££j*U Fp, 1-fcfc>*>f (mod p) O 

MWz&zffitimx'h&o 
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fe5 0 2o(D7°nir^f- • * * f-^V^X-^ 1 0 SfccttFl 5 5tt, ir^r^ 

tir^S 0 <$-f 1 0 5fi7°nir^lM 1 O^r^a^; J* 15 5 

«7°nir-/f- 16 0 ^r-a^fo ^n-fe^i^ 1 1 O^JzTM 6 0 £ ^tU-HSiS-^tH] 
KSr^OJ:^ (;yn Jf^J^-tZb, ^fLb^m^X^W^m^MM^W: 
L v ^W^fe^mfi^ffiSr^i - *- i: ^-e^a e -^ts/tl 1 0*s<fctf 

1 6 Ofi^rtt^n, ftlc^^^*^^ Tc^xJM^xV*^ • loirs' 
f - £ fefi-r >T * p 7 n y -C «t V \ ffit<£>2JUB 7° p ir y f- * tc te¥fW § W 7? 

^ m i o r H fr-T <5 w £ <® % % & & *W * fc f4 0 88 ^ ffl T * # 5 r ^ * s 31 
C ^$^5. ^nir^lHifci^i^ Intel P e n t i u o -fe y -^"C 

2 1, AWillS, *^12 5m, r*Lfctti--<T^3feS'^««© 
fc©"?«kv\, A^fl i o 3 -C/TLfc^-^- KA^^rtfeS r 5 C 
mmithy>^>-y<l 3 5 &j\-\^Xftt>tls f7>^l 3511 ^fA> * 

iO^W^HJfe^fig^-^^v^^T 1 -^ 15 514, f-^'^Ti^ 10 5 fc|Rj«Jfc 
i^ftSrt^S, /ntytl6 0lt Pig-T 5 AtH^(HS§ 1 6 4 , 
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(17) #82 0 00-5 1 6 7 3 3 

Kl 5 5^£tL5o t^fA 1 5 5 t t <^iHf Yt V 7 > 
1 6 2 ZftLXftfrtl, ^<Dm^i>> 1^7^-^16 21^7^, £fc 

w ©^hm**^* ^^mmmm^^immn, 2 oo» P *s «t o< q & 

^3&PJ©R£-Ph>;*^r.M^ M. Blumfdl^ TAn Efficient Probabilistic Public 
-Key Encryption Scheme Which Hides All Partial Informat ionj (Advances in 
Crypto logy: Proceedings of CRYPTO 84, Lecture Notes in Computer Science, 
|196t, Springer-Vcrlag, 1 9 8 5*fv 2 8 9^-^^V^L2 9 9-^-v^) 
&£Tfs. Goldwasserfrtl^F TProbabi I istic Encrypt ionj J. Computer and System 
s 

Science 28(1 9 8 4^), 2 7 0^-^^L2 9 9 £ fhtzM^ 

o ft#ik*s z>Tfiiz.mft&ft. *&w<d&w;% fern Lxttrntf} ftmz.fr 

mftmWiZO (NO mx?1bY). tfc*SoT, RSAtM^tlSO (N 3 ) f@ 
wHIin^^ii^^o iftftO (N) -efctJ,- R. J.McEliece^ TA Pu 
b lie-Key Cryptosystem Based On Algebraic Coding Thcoryj (JPL Pasadena, DS 

-17- 



(18) 000-516733 

N Progress Reports 42-44( 1 9 7 8¥), 11 1 6^-^)43 

£0*0. Goldreich^^ TPubl ic-Key Cryptosystems From Lattice Reduction Pr 
oblemsj (MIT-Laboratory for Computer ScienceW&> 1 9 9 6^1 1^)^15 

mztitcx oKttKD t^mj ^t^^A-eM^tiso (N2) m&\zm 
5o ^(ommmmts mr = z cx] / cxn-d R*FeRii#« 

F=^F |X N -' =[F 1J F 2 ,...,F N ] 

3?±-<?ttfcV\, Mi:*t^ ri» ([[ ]]) rt^ryT/^lt, 
ai x N-i + a2x N -2+... + aN-i x+aN 
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(19) !J#^2 000-516733 

[a 1 , a 2 aN] 

;*:tvvi§^ Hfr-f 5^f-7^N2it1i^< N 1 o g N^^T-feSi^^ 

N=5£U 2o»0J^ftft^;££ffii^$&£\ M%im&\ZSiT<n& : & 

(x* +2x2 -3x+2) * (2x4 +3 X 3 +5 X -1 ) 

=2x8 +3 X 7 +4 X 6 +5 X 5 _6 X 4 +1 6x3 -1 7 X 2 +1 3x-2 
=2x3 +3x2 +4x+5x-6x4 +1 6x3 -1 7 X 2 +1 3x-2 
C) =-6x4 +18x3-1 4x2 +17x+3 

[[£±fc->X^fJfc£;tfi£, N= 1 6 7*fcttN= 2 6 3Mt5r^^' 

ffit5iHSf#5 0 ^J;W^T^^^ffl^o^-C«, fctxitf, I.N. Hers 
tein^TTopics in Algebraj ^#I8H~5 - £ 5„ 

dS«E^$ix5 0 rcr^iiS^^ #ffift*q^l»U «*Sr-*©*Jsfet?«* 
2 3 7 7*l2 81?l»t5il8-e*)9, 3"?*)5©1?, ^ 

Itii7 3-ef^iif 3 tia 0 ua>u r^pj^j ^^bfc^^-efos 

, q = l 2 8(C^flJ^^^^-rS#^> -5 5 = 7 3-i28-Cfc5©t2-3 
7 7 12- 5 5 T-fi#&;i ^^^o 

mod qj t*|:fit5o £*TK, 2o<£>#3S5£<£>SI=P^g& 5 

-19- 



(20) ^* 2000-516733 

(x< +2x2-3x+2)* (2x4+3x3+5x-1) =-6x4 +18x3 -14x2 +17x+3 
=-x4-2x3 +x 2 +2x-2(mod5) 

N=5, K = 1 s p = 3, q=l 2 8 

N=16 7. K=6, p = 3, q = 2ie = 6 5 

L g = -1, 0, 1, 2T-fc5#*MirU 

L*={2o<^-i N 2 0(01, 1 ocoo UT^ri - ^ 3 !^} 
L^= l", CK 1 ^fc^*^} 

Lg= {W-l7 74^L17 7tfc5#5S} 
2x4-x3+x-2tt^ L g 
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(21) ¥fi&2 000-516733 

x4- X 3-x2+1ttH^L# I:#4t5, 

ro« g roW4t5o Da n^^I^tStWil^tSo 
f = x4-x 3 +2x2 -2x+1 
g=x4-x 3 +X2-2X+2 

[[^^v-^^Afi/d^x.^ K+l{®<D#JS5£f , gi gK £LiS:K = 

Fq * f = 1 (mod q) *3 «fc t* F P * f = 1 (mod p) 

5 0 ) JhfE<z>0!l f -Cfi. 2fe^SfiJSAi-5o 
Fq = 1 03x4 +29x3 +1 1 6 X 2 +79x+58 
Fp=2x*+2x 

5 0 

Fq *f = (1 03x4 +29x3 +1 1 6x2 +79x+58) * (x* -x3 +2x2 -2x+1 ) 
= 256x4 +256x-1 27 

= 1(mod 128) 

Fp * f = (2x4 +2x) * (x4 - X 3 +2x2 _2x+1 ) 
= 6x3-6x2 +6x-2 
= 1 (mod3) 
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h^Fq* g (mod q) 

1" 5 ]] 

hi =Fc*gi (mod q), i=1.2 K N K=6 

-©fclTtttt^T, DaniS^S:tHt-fS. 

Fq * g= (1 03x4 +29x 3 +1 1 6x2 +79x+58) * (x* -x 3 + X 2 -2x+2) 
= 243x4 -50x3 +58x2 +232X-98 
=-13x4 -50x3 +58x 2 -24x+30 (modi 28) 

O Dan (D4kfflm*£XT<D&^ x **>%° 

h = -1 3x4 -50x3 +58x2 -24x + 30 

Dan^ffitii^^ (f, Fp) T-fcSc Fp fitfUl f *»fcfH* 

a thyiSDa nO«h «ttD a n ^ ^t-^Mt5M^fc 
5tfim„ Ca t h y«"ST«i*^ yfe-^O^Li.d^«>5^ y-fe-^Sr 
3l^o C a t h 

m = X 4-x3 +X2+1 
0 =-X 4 +X 3 "X2+1 

e s= p 4> * h+m (mod q) 



-22- 
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#l^fflt5ri^"e§5. Ca thytt, ^ yt-^fftt5i: * 

-g-L* d»5>Kfii<7>#gC^*i *K«rasf£&fciB&U &v^e=p<M*hi + p <*> 

2 * h 2 +. . . +p <*> k * h K +m (mod q)Srtf»tSiil:±ot^W Srf^fife 
t5ii:^#5. ]] SiJfeibT, h^pF q *g(mod q)£^L<£;ft^ 

M-Vi*. Ca thyliWfH^^, 

p <*> * h+m = 3 (-x 4 +x3 -x2 +1 ) * (-1 3x4 -50x3 +58 x 2 -24x+30) 

+ (x4- X 3+x2+1) 

=-374x-» +50x 3 +1 96x2 -357x+487 
= 10x4 +50x3 -60x2 +27x-25 (modi 28) 

Lfc#o-C\ Ca t h y »lf f ft^ 7 t-^ligT«»tfc !) , 
e = 1 0x-» +50x3 -60x2 +27x-25 

C a t h yliCOffft^ y-fe — v^D a nl^ft5„ 

a = f*e(mod q) 
^fflf'WM-efi, D a nfii^T^fi-^^tT^o 

f * e = (x4 -x 3 +2x2 -2x+1 ) * (1 0x4 +50x3 -60x2 +27x-25) 
=-262x4 +259x3 -124x2 -13x+1 42 
= -6x4 +3x3 +4x2 -1 3x+1 4 (modi 28) 

a = -6x4+3x3+4x2-13x+14 
DaniiFp, g ft<DHfmm<DttLj?<D*ft&®im UTWT^fm 

F P *a(mod p) 
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F P * a = (2x4 +2x) * (-6x< +3 X 3 +4x2 -1 3 X +1 4) 
=34x4 -4x3 -20x2 +36X-38 
=x4- X 3+ X 2+1 (mod3) 

a lM 

a 2M 

3 MM | 

( ) f , g , W1 , W2 WK 

£P^ 0 Clft^fT^JfcJ:. f, g, wi wK^&9/h£^^£WU 

wi = 0 (mod p ) 
CB^8U*Ltf, $)^5wi^fc^5W s P©ft-r'fc5o ) Dante, 

&g#fc5„ Lf^oT, p a nl4,'»S*ifctRrt©ff?lJFp, Fq, Gp, 
Gq £JLotf-5o 

f F p = I (mod p) 
fp q =I(modq) 
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(25) 2000-516733 

g Gp = I (mod p ) 
g Gq = I (m o d q ) 

Dan©«, girv&ftfcX^XIkfe&inZKmoft&l (hi, h2.... 
. hK) <D$tXfX*fo% 0 

hi=FqwiGq (mod q ) (i = l, 2 K) 

Pi (wi &p Zmt-fZHa ^^T'fcSr t^«S:$tbfcV\ ) Dan©||i 

\$4-D<Dim (f, g) Fp, Gp) T-fc6 0 JjjUUJft^ f *3«fctfgtf>^£^ffl« 

ZftFiXhZ> 0 Cat hyli, $&<D* y±-iS*n^rlk'fZfZ#>^ 

^fc-t-iKo^^ui <pKSr«8^^a^-r.5o fc^tf, 

^T^a 0 Ui b» fT*j^ttfcv^fci-fmsftfcv\, .pus 

e= ^ 1 hi + d> 2 h2+. . . + <f> k hK +m (mod q) 

a == f e g (mod q) 
Dante, a#^*5 0, - q/2^tq/2 (-ffcfr"^ *d#fis»«fc) ^0 
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a =^lW1+*2W2+. .. (f)KWK+fmg 

±^S, q^if^f^lfrii/^M^C^Srt-efcSo ) Dan 

So 

b = a (m o d p ) 

b=fmg (mod p) 
FpbGp (mod p ) 

^ LfciSoT, N^@^ 'y-fe — v 5 * N = M2) *7jk-rm&. ft 

tmmmM, w&itwio (n) fi^f^ws^u ur^^o (ns/ 

(N2) fBo^xy^Sri^Si: flM^O (NO iro^fy^MH, R 
SA^Hft^^fAtt, n-&4WzO (N3) ||«^TS'7 , «:Mi:L«ti:o ( 
N3) io^ry^MttS. 



(27) ^2 0 0 0-5 1 6 7 3 3 

($fc|i|4«4mee t-in-the -middle) T9v9* 

z^-tzttikcDmb Lxm^titcm^, v-y^^m*. 

/d + K-l\ (dtK-1)! 
[ K-l ) d'.(K-l)! 

2'03. Bfa 0 %%&#1rZVi'7/\'&mmbtiZ>o 
4MMH^XttKM* l o g2 (g) t^htfe^ fffitt^X(12M2 1 o 

g2 ( P q ) t > h-cfo^o :Jif>ii*i«^WXffo^ 

fj/f • S^^A i 5 5 ^zx — if tfS^orfc y-fr • 1 
^TAl5 5©a-f) {I J; o -C tffl 1 5 I i: I ^^t= 
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(28) ^12 0 0 0-5 1 6 7 3 3 

Bfr-frfl^ W*3- J r*/i'5 0 (Ell) HttM^So 
^-^^^i- 0 r<7)^ft, ^ftlt^^ffli-ST'niry 

fjtli, /ntj/f • i/xTJ* 1 0 sw^nt^ti 1 ote^vfyJ^-rzizito 

2 5 tiMf^^^jg^ f ^ g1% g2 . . . gK(DjltR?r*i-o SL^C 

f 1 1 -Cfi^^tL, :/n S /^130:fc5<fc'tfl85 Tit £ $ ftTl ^ 6 0 

^n^y 3 4 OH. aB^SF*©^^ f (Z?ia*»[Fqfc*J;t5Fp*s#i&i 1 54i^ 

-r^r^^^-To Fp, Fq^^EUTfcV^^ S^n^ 3 2 5HA5, ffL 

h = Fq* g (mod q) 
-28- 



(29) #g 2000-516733 

K±5^M*h©tf-*«r*-r. [K>iro^, i = l, 2 Kfco^T^ 

5 5 (Hll) ©yotyfl 6 OJiifcyotytSrT'n^^^tS^-f ^© 

r -- Oh 7^^A#^*iSa^*ttS(^n 4 3 0) o [K>l©i^ Kj@ 
©*lf^#«S: * 1 , <*>2 *KiS»^$tLS 0 ] r<E>#JS5£te, fltefco,}: St- 
5 0) o 

e = p * h + m (mod q) 
hi+p02*h2+ +p <j>K*hK+m (mod q) s/-fe— ^^A- 

(_*:■ -if i-iHlf f 5 (/p^4 6o) it 5o 

, q^^tf^$ttTV^5^«ittf#iS5tt)tti$^5(^ay^ 5 5 0)„ 
, ^/^ 5 7 Ofi^^cDff-^^r^LTV^o 

a = f * e (m o d q ) 

nrims^oy^ 5 8 o) 0 

m ' = Fp* a (m o d p ) 
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#fftfC[g]2c7):/n 2 1 OMoT^^fc, ^§fl^ 

^rcD^iJ-e^ Lt, ^ntyt • v^xA 1 0 5(Dyotyt 110 fcyn^ 
7Af5ri^T#5 0 ^P^ 6 0 5ll, l|[/-?7^-^N, p, q <Z>jl£R£r 

6 1 5fctK©iift£^U K*3l^1-Srttc:«toTtT^Jro» s ^^ixS„ & 
fc, :/n 5/^ 6 2 5 te^V^-Mf^J f » g, wi, W2 wKtf>51IR<t, wi , 

W2 wk*s^t, P **fefcLT0fc^i!^fc"s^5£#fc*£i-o :© 

, ;©sw©tftt-a»^f 130 (mi) ^ffitsit^s 

©fT3W#£LfcV^4&'£\ ff^' 3 S'^6 2 5 tAt), if UV^T^J f £5<£t^g /5 s 

*>* «T^#l:j;o-Cft]l$^5K<S^ (h1 ' h2 hl() ^ * ^ 

hi =FqWi Gq (mod q) (i =1. 2 K) 

Zfuy? 6 6 0-C*£jh/CV^S £ ^ffl»f±fT?lJ (f, g. Fp, G P ) M 

'■fZ>£.0\Z.yx2±y-V- . v/^fAl 5 5 (ill) ©T'otytl 6 04^0^0 
MtblH-efc5 0 flF-!Hfc£jixS^ 7t-^^(^n^ 7 2 0), 



4>2 *K#aft$*LS 7 3 0). itlb^Stimt^gf 18 



(31) tS2 0 0 0-5 1 6 7 3 3 

5 mi) tiotl^t5ii^$5o &^T\ ftmk* v±-^e&nk£: 

<D£.oizmm-rz>z.t&x«%z>(-7w? 7 5 o) D 

e= $ 1 hi + # 2 h2 +. . . + <t> k hk +m (mod q) 

z.cn'fo^WL* ft^5 0^LT«fi^f, -r&fc>*>, rc75^y-e 

' 0) o 

p ; N, p, q irSr'g-tf^^ixT^S^ffliifflf^s^r) ffi^tiS^a 8 5 0) 

o /n>^8 7'0fi^Otm:Sr*b-CV^6 0 

a = feg(modq) 
JfcK:, ait ^©J:5SC N p^tLTblcil^tl5(^n^^ 8 8 0) o 
b = a (m o d p ) 

m ' =Fp bGp (mod p) 

teMtommttmit, tit*.}* r^-h . kj .hmisttu n-sirit&xxf/ 

NTRU : S-<-^^i®Stf ~>7tA 
JEFFREY HOFFSTEIN, JILL PIPHER, JOSEPH H.SILVERMAN 

mm NTRU, r^^^ff^^fiftBf-^^^^^oV^TlftK^-So NTR 
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(32) #^2000-516733 

0. 

1. NTRUTy^'UXA©^ 

5. NTRU©!^^^^^*'^^"^ 

6. fdl^PKC S k(D$M 

§ o. iiUfcd 

D i f f e^He 1 1 ma n [4] if © J: 5 tbtf 1 ^iRlBB^Srffi 

RSAtt, 1 9 7 8^{^R ivest. Shamir, Ad e lma-nCiot 

(-*^<o fifeOD^^^t^Ji, S"9iIE^{lMt§McEl i eceS/^X 
A C9] fe^-Mffifflm^M&l^" 5 < Goldreich, Goldwas 
ser.Halevi [5] ^JRiS^^*^"-^ 5 ^ *tbSo 

, If^tt^i^^^-f^^V^TA^tSo NTRU« 
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(33) #^2000-516733 

$Sv^^ h/M?«:#<) ffifc-C$Si^<^ h/i'SrjS.ottSw fcasffl*i-e*>5 n £ 

, e ^ —;l>$:jl- LTD onCopper smith, Johan Hastad 
* Ad i Shami rd^lV^i:©3^yhiftiE©iX [3] *0>#& 

fcLtz 0 ^(Dm^^mm^x, ^<Dw^m^m^m^^x^tct£\,^ti±t&(D 

NTRUfi, [1] *5<fct/ C6] ^|B*$*L^:«fc5liH»W#'>^f l A<Z>-«: 

^^^^^Sfc^-f-rS^^^^^^O (N2) j@Tfe'9, RSAt?& 
Hi^tlSO (N3) 4H(£>2RJ*J: «9 t^OflltfcSl i^g^$tbfcV\ $ 
NTRUitftteO (N) [9, 5] *^flfc© rffijgj 45? 

SiJii'so (N2) jistz:iz6*-r*. 

§1 NTRUT;^ y XA©RK 

§i.i seiesc 

NTRUBtf^rAfi, 4oro8^7^-^ (N, K, p. q) Wfc 
#Mff5N-l^II^3 0(Z)i^Lg, L*. L m ilMt5„ ^R = Z 

cx] / (xn - i) zmm-r&o siFeR^«^fc^^ h/^t ttt 
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2000-516733 



H k =|f,G h +1^0^ = i+i _ k |fjGi © * - V F ® G=H 

(fcfcjfctf) qfefei-r*lftJ|l«rfi l 5», q**fcLT***SEtfl 

a * W f*J . fft F ®g cr> it ^ I- « N 2 m GD 3S J£ S T? . 

. S & # ft.-* IU L tc ifi -o T , F®G toff-l* 

§1.2 *e>f&$ 

NTRU«^t5»^ Dante, K+lfH^^^f, gi gKG 

^sfcftt, q:fcJ:tfp*ife^5a»***r-rs*:V % 

F, <g>f = 3 ( raotl q> *5 «fc Of F„ <S>f^ 1 (mod p) (1) 



(34) 

F — JTf,x n ~' — [F,,F 2 ,...,F n ] 



(hi, h2 hK) 



(35) 2000-516733 

Da nfD^mmn^-O^^i -e&5„ 7t7cU ^t-iix DanUFpSriS 

§1.3 W^t 

Cathy (^^-«IJ) ^Dan m^\%) K * y-fc — v^i&if "f 
5k<D<b^1-5 0 Cathylitf, 1 Lm ^m&iltR 

t"5 0 C a t h yfiK^@©#^*i..... *^L* £«^^3i*RU 
Dan©« (hi h 

k) ^ffiLT^T^ft^^o 

es^piji, ®h, + m (mod q) 

C a t h y^'D a n irZ>ft-%rik* y± — i?X*fo% 0 

§ i . 4 m^- 

DantfSCa t hyi^^ f^eSrSflLtfc'tl, S #<0*ffl* f SHEffl 
anlill. lgfjTtM b7^#^F**^-fHlLL-C*3<'<.#-C'feSo 

B = f ® e (mod q) 

Da n «-q/ / 2^^bq/2CO^[i«-eaCO^#:^il^-r^o 
Danfi, a ^Stif t^^i^^ tt, #Ttf>fHI£*T 5 - £ (C £ 

Hp <S> a (mod p) 

w±£tizmmi*Mtbxmi<^ hzuv*? 

^?&yFM%]Vab& - ^"CfcSo Dante, 3 

H/2+x&V»[ / q/2 + x~Ca = f ®e (mod a) CD ^ gfc 
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(36) #it 2000-516733 

a S f®es|f®p^®h, + f ®m(mod q) 

ajjf ®p4>,®F, ®g, +f ®m(modq) (2)i0 
= gp«t>. ®gi +f ®m(mod q) (1)<£0 

p(J>i ®g, + f ® m 

^^mt\^t^\ r©rifi> Da 
n *>* % q ^ fi t T 5 f ®e CD ^ » S - Q / 2 ft lr» b a / 2 © lifl IS C 

Z[X] / (X"-l) *5 ^ ~C a = ^P*i® g. + f ® m 

*V>T, p ^ ted _ l, -c a S I W t 5 t . j£ f @m (mod 

p) &*Zbfr,.F 1 >lz£Z>m&lz£<>X*iy- ; t-i?m (mo dp.) tfSJfc<9&£ 

§ 2 ^9^— 

§2. 1 ^fE&il^V 
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(37) 



mm 2 000-516733 



mm BM(D a XH-o^T. £ , N. KlI^CTftcK c2>0^fc»), L 
fc^ot, M^^iS^^tLfc^JS^Fi Fk, Gi GkERCoV^, 



§ 2. 2 y-lsZ/jV^m 

Lg= {geR: gfcfc- (r-1) ftV>L (r-1) / 2 ©#Jfe£r^1-£ } 

L* = U ER : lil^UvdiiDiti:, - 1 Kl^LWf®^^^ 

L m = (meRimii- (s-l) ft^L (s-l) / 2 <D#ifc£r#-r 5 } 




1/2 
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6 L L 2 y;UA I <J> I 2 = V2d £ ^ U . ^ni:MbT. ^P^^^ 

g^L^^meLjiLVf A I g I 2 = VN(r 2 -l)/12*5 =fc I 

m i 2 = vn(s 2 -i)/i2 Ht^tcfcsisnfc^. as aa * « « £ 

■tZtcl&iZ^ Lg, L«> L.©5*© s P*&L2//l'AS:Li, L*. Lm kW< - 

« ^ - t T? 7t£ <^ . L m -P L 4 i^^>ain»fi^Srff 

-N / 4 S-iS^i-^-^ i {£ « T . ^ CD *g -& , s -V5 p « 5 tl 

§ 2 . 3 m^mm 

1- 5 T 35£ L ± -5 »~ - I 2 r> <£> , ®s , -J- ■ f ®m I - < a "C 35 

^ (3) OTLT (K^ft:btH-K'+ l£fflV\ £ t Lt+^DJ^^fi?: 
lYrti ®gj +f 

~c 2 L g (KpL,+L m ) 

~ c zP L g L, (K + 1) (L m - pL,t (£56) 

L/c^oT, (flS^l-f-e) m-^^^t^fcfe^, Dante, &>T <0'&-%rffltt} & 

c 2 p Lg L * (K+l) <q (4) 



(39) mm. 2000-516733 

§3 t* a yf-fM 

§3. 1 Meet-in-the— mi.ddleT^y^ 

1 "C * O . Ufe^s-^-c. raF-^-fb^^-tr — i^>5«e=<J> ®H + m (mo 
d q) £ LT*£;ft5 fc0>£{R3£-t'2>o Andrew O d 1 y z k o 11, 4> 
I^LTftffltSiirottSme et-in-the-middl e T ? y ? 

o f¥Cf^if, f &f = 
f ,4- f , IC ^ fU u . f , ®e - f 2 ®e t ^ ^ ^ ii . 

§3. 2 ^fiigffT*^ 
^JiDlft^£ffi]|i(;i-r3fc#>^ K= 1 tIStS. Ca thy^\ 

Wimz.WZ-\-£s Cathy 

** e , e <*> , ®h + m (mod a) (i = l. 2 r) & M m -? & 

<t & i£ i£ & * Be t t y li ( e , - e t ) ® h " 1 (mod 

q) SrftJSU *tUZ£oX 4>i -*l (mod q) ffit^I^^^^o 
Lj5»U ^O^fgctt^^t^/h^V^-C, B e t t yn<t>\-4> i (D^-^r^^L, r. 

) T-fe5#^-C>b. Betty fit. brute force tj;oTt^T©pI 

y-fe-v?K>fi&<D^P>^<?D^ ^ 7 zszfl) ^f&ftfr-f^m&im&ft? r £ fi££r£ 
L<fcv\, Be t tyiSf-©7«yt-^r©J:9l^tt5#^'f), :w 
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(40) 



4$* 2000-516733 



§3. 3 &^<— *<079v'# 

M^^-SS^fv^^ wttfi^Rr^fcSo Schno 
rr [11, i 2] ^oitZ-tcDte^ioT^^^^^i^ife^tLfcL e n s t r a 
-Le n s t r a -Lo v a s z [8] ©LLLr^yXAtlt 
TM©*/Jn^ h/^Eo^^^, &7Etf>*#& (Tci^^ ^10 0) fc^t 

■t *2k5c £ ifl-T S T<£> 3 o ©<Klft & % *. 5 „ 
(Hi ) fcVNTV^J&^M-ef^ M©*/h^n • ^ F/HZ>«£ a (M) 

SI D isc(M) 1/ ^ M '^o(M)^J^^Disc(M)-^ M > 
V 2jte V J»e 



(Hs) (H 2 ) ©jRftTife*^^'*"*' ^i^^ ^i^feiaotitii 



)v|s ^dL^) Disc(M)1 




(41) 4#«2 000-516733 

| VLLL | ^Kdi«>C«> | W | 

& (h 2 ) (H 3 ) \z.&t>tizte*mmfe&*ft. m&&£Tfimmz. 

fctK ir^y^fc, ftp q&®&#MirZ&&<omm(Dmfe\mftirZ>o - 
[5] tzHS«$H^PKCS^«tl9lSMU-C*3t), PKCSWir^rayr 

itLT^S. *5E©**fc Uioo) *ft)8V^»l:J:ot, K=l. 5 
,/,00 MT'^:H^t^?)o (Tcir^^s [1 1] *5<fctf [1 2] 
*#J8$;h,fcV\, ) H^^^tf^otLT, RSA PKCSt^W?: 

(Hi) *5J:tf (H3).«r««i-*^"^-t v ^ ^©J;-5*itG«fe7c©*^-e^ » 
^ioTttSchnorr©^ 

o o(Dfe?-izn^xi&m (H2) (Ha) &{ELfe-f%m&, -rotrntitcW} 

§3. 3. 1 if^t^ft^^y^ 
/h£&^<* h,uf ^ft5 0 m^^T9^tt. hi= [hii hm] irU 
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(42) 



l&m 2000-516733 



0 0 
0 0 



h i2 h i3 



1% hj, 



q 0 
0 q 



d i m (M) = 2-Nj3±t^D i s c (M) = X" q N 

VtargO = [A f N X f I, gi I giN] 

Vt.nWSi tliiot f *S4"Cf5r i:^e#$nfcv\ Ld»U vt 



|v.J a -VM^l».E-L.VX?^l 
tfEtft (Hi ) IZXtltt^ I Vtarg | 2^gJlT©m^lttf^, fttT*y* 



dim(M) Disc(M) ./dim(M) = /2NXq 
jte V Jte 

8 V «e 



(43) #^2000-516733 
q ^ (5) 

tf « CD s a ^ ^ b > [ f ' . « • D . e M » . f ' <t n , <s> f " s 
g' (mod q) j&s#fc/h$l^V^W£*#1-3o L^U T^^^^T 
e ®f'= ^p^jOh^f'+mOf'Cmod q) 

©hj ^fSHc^LTV^ w £ *r**U 
§3. 3. 2 if|:*ftS^ft^^y^ 

U^Wt§:i^t^5, T9v%&. hi hk (l^k^K) £ 



/XI 


0 


0 


0 


• 0' 


h, 


qi 


0 


0 • 


• 0 


h 2 


0 


qi 


0 


• 0 


h 3 


0 


0 


qi • 


• 0 




0 


0 


0 • 


• qi 



dim (M) = (k + 1 ) N*3<£^ D 1 s c (M) .= A N q kN 

vtarg=. { X f , g 1 . g2 gk } 
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(44) ft* 2000-516733 

Ki 2 -VK-is 1 i^-ki:=L.^ 1 ^' 

^Htfe (H2) iatlil vtargCD^^^^fcLT^S^t^ ft^SffiT 

| ViKg | 2 S K -^M,^dii^ D;sc(M)l/(Um(M) 
= K -(K+1)N / (kn-l)N .^i/cm-Dgii/cfc-nj 

g V xe 

^ t><Ri» (h 2 ) <^r-e^^«i^^fc5„- 

q M W )g K (-)«L 8 j| (6) 

§3. 3. 3 ^/yr^ifl^tS^T^y^ 

m h , ®K Cmod a> & ^ 7 'J 7 X ® C T a (C tt . d *T <£> 'J> 



G , = hi , CHJF" Cmod Q ) (j = lv 2 K) 



(45) 



4#ge 2000-516733 



0 j ®G t + <t> 2 ®G 2 + • • • + * K ®G K + m ® F 

T(if4$t^i:5), 

rtO*/h^P • ^ h/W2^ hA-vtarg= U f , gl g.K } T'fc "9 > 



vlll= [IF, Gi, G2 Gk] t-fZt, JSfe^s^iti-5Ct^^5o 



-tz>f&tt*m-tz> 0 |if h, i gi | 2 I gk \z& 

. I IF | 2 , I Gi |2 I GK |2^k(K + 1)N L g 

-^•> rtti (3) ^u-cwi^trUHs-etSo 

|4> ,®G,+ <*> 2 ©G 2 + . ..+ <*> K ®G K +m®F| m 

^c,<|<*> J 2 - + kU • |G K U + |m| 2 • |F| 2 ) 

= Cl L„ (IGJ2+. - + |G K | 2 +|F| 2 ) 
> Cl (K + l)L^ L b k 

Wq£ci (K + 1) L * Lgk(K + 1)N (7) 

(-HSrttt-i-^S; (4) ^it^tSlt^t't?.) 
§3. 3. 4 fg^cD^ — S^m*M - 5*» J f-T* 



| VLLL | 2^ k< K + 1)N I Vtarg | 2 




(46) tf* 2000-516733 



/ ?J 


0 


0 


0 - 


0 


0\ 


0 


XI 


0 


0 • 


• 0 


0 


0 


0 


XI 


0 - 


0 


0 


0 


0 


0 


U ■ 


0 


0 


ph, 


ph 2 


ph 3 









d i m (M) = (K+ 1 ) N*5it/D i s c (M) = ^ KN q N 

P <*> ,®h 1+P <Z> 2 ®h^- + P * K«>h K +m^ e Cmod q) 

e-m (mod q) ©ff*^*<*^®^ < 8 > *S«V^ h/WCfc*^ 
^ot, «*n.©#ft^<^ h/^ CO, 0 0, e] b/V$:M-C& 

Vtarg= C X 1 » X ^ 2 ^<^>K, — m] 

flM***MS*ft < <d £ & o * < - * * s ° L 
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(47) 



&m 2000-516733 



I * 1 2ffc5: ££ffljg£*i<7tv^ (H2) fc.fc*Ui, j?cS;*Sfi5£ici-*#-& 
[dim(M) Di5c ^ M)1/dM M) 

fcS^ttWVNjfc*.™*, ^aMfcAi-Si*^^ T^y^tt5felfc-f-5. 

q .Mg K (K + l)N L ^p>^) (9) 

^<7*£te, rtiiaot^Hs (e) tJtKts^fcms. 

§3. 3. 5 1&*7.9 • - /<7 *—*fflffo<V^ffi 
(4) i*^y^h-r^> 0 

c 2 pL g L^ (K + l) < q < 4 > 

q 5^1 (5) 
N 

q ^^.)g K ( k .i)N L ^^^ (l^k^KOilt^bt) (6 k ) 



(48) W*2 0 0 0 - 5 1 6 7 3 3 

W„g c, (K+l) L<D L g K < K * 1)N (7) 

q^^I^I^ (9) 

* 5 US ( c #j £ * 5 v ^ < o rt>cD a M * *I t c o v > T & ^ 3 o 
tf, rtLP>^)^#^;^^^^fe-em^^So £1% (4) i: (7) £ 

(K + 1)N^*^^ do) 

' lOgK 

(K+l) N(DTPS^#^^ ^*LSrje'^.6^fi^A/^#JW"C**<*5^^-e*> 
5„ 

(4) <fc (5) *»2^fr**fc3fc*tf s #kft3o 

L > C ^ K+1 >^-L, (ID 

e jte 

q£ilHK-f <5|^(cvK &*iJtf^ 5 l-f^ Lg^ffiirLT, f^^ti^r 

VTmxVh Vzb*Lt£) l. 5ffiF*v^L2ffiF^:%3Q;ffl[S:ai^i-Si: J:v\ 



VN(r 2 -l)/12 ^ « f c T . [✓ /t -p T , (1 1) Si^fflbTL^l^l/ 
fc «: , r = L L . V12/N J &l«t5:tiftt. SB 
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TX^(DX\ Danf |j|iLi©y^S:tt5L,^S4K + 1«©#«« 

y * ^ l e, uftM ^ b-rtftac-c # 6 £ o a a^frvN, 

§4. 1 -fe^^y^^#^<tt/7^t D ^^^ 

W^/h^-rr> fc£*tfW=l- 5ffe5i^ T** (# 

Coppe r smi t h^Shami r [3] Wtf r tl X <0 t>*# ft 

5, Nfi©5fc*i©fi|^oV^-C*b0. 6 7Ni©-^i^#5:^ s t#5 
£#*fc 0 Coppe r smi thWShami r ttfcV^, T*V**Z 

Q ft^^^W^^^a^l <^^" C#?)i:#;t " CV ' 50 Coppersmith^ 

i *t 6 o r t \zm^ - -c . ^ * ^ y ^^ w= 1 0 L T * ^^■m^ 

§4. 2 f-^^Hftf^x-?^ * — * 
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(50) #f 2 0 0 0-5 1 6 7 3 3 

c, = 0.O8, c 2 = 0.24, W = 10 « S 1'.S»'»" - 1.0040628823 

* s *)5o ±M<D%i4. 1 Sft-e^ 5> t°^^#fcW= 1 0 Ko^TBfeCfco 

= 1. ^ - ^ § ^ 5o 

(K+ 1) N^ 1009. 79 

N = l 6 7*>J:tJ ? K= 6 
(Ni (N-i) 2^*{c:?fl^-e*>S^»fP^t?feSo fcfc'U ^tUi&Kft- 

ijlfime et-in-the — .m i d d 1 e TV y t \Z.tt~$-& J r 
-tt^oa^JfeSr (1 1) fdft^^-S^, Lg>4 14. 0 7m?)H5. ^ 
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(51) ^2 00 0-5 1 6 7 3 3 

SII16 2 2. 9 8i:^b<45. ftiH, 13. 3. 5 «SO 5 OfDl^f^ 
<fc «9 , q tfs#:5t£J«fc $ ft tt*tfc£ ft ftv* r flSfc>a»a 0 

21 3. 6 92 4 <q^maX {214. 2766,214. 7278,21 4. 6238,25 2. 481 } 

(*>*>5A,, 13. 3. 5i5^^ (6k) teHI&Kfi, #ia^6^II 
loC6o©^T«fe5, ) LfcaSoT. q = 214 - i = i 6 3 8 3 %WR-f 

5^tm§ 0 (gc d (p, q) = lMitfes: tn:e*$ttfev\ ) 

^NTRUPKCS^t^So 

N=167. k=6. q=1 6383=21 4-1, p =2, r=1 67. d=20, s=3 

^IW3iS = Nk 1 og2q = H 0 2 8 t>h 
^ffl#S = N 1 o g2 p r = 1 4 0 0 tf * h 
^ — £?Jfc§R = 1 ogq/1 ogp = 14*fl 
l^ft#tff Lt, «t 0 P ZtTtZM 2 CD 1 fiO^iNTR 

U^7^-^^iifS e i-^TO«#*S2i»«tO t/h*ft«f-*tl-"Cfi 1 ^tL, 

N=167. K=6. q=2i 6 , P=3, r=354, d=40. s=7 

Ztlb<Ds<7 J— L<=167 !/40! - 40! - 87! 

„2 2 3 9 " 3 ^ > ^TC73fit^^-^^)c 
«*-NK 1 o g2 q = 1 6 0 3 2 \f y h 
M«fe£ = N log2 P r = 1 6 7 8 t"^ 
>5/t-^fei=l ogq/1 ogp = 10. 1*U 
§4. 3 2MNTRU^<t^M^ yfe — i^lfeffi 
8U. 2^^^L7ti^->'^ 0 ^ * PKC Sii^^^T^^ 
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pSrffiffi-^Sr. r.0>#£\ (K+l) ' N<£Hfias*L<*£<ft!K 

e-^p<|>. ®h, +m (mod q) -fe J: E = m®hj + M (mod q) 

(e, E) -CfcSo 

tfo LWot, «ffl(|©Danli, ^ 1 . 4 gj5"Cl^0J bfc^lH^^o 
m£r£HH-5 0 Danli^-e, ^f|-It5: ^!:J:oT^ yt-^S4 

E — m®h , (mod <l ) 

¥3C^ y-fe — v^MWS-^^N 1 o g2 q h-C^O, -ttbtC^ LT^^ y 
-fc — SMe, E) 2 N 1 o g2 q \f y bX'fo 9 . Lfc^ot ^ y* — v> 

&3Rtt2*n IzWPirZ ^#^.e>tbSo 

CatHy«S^:-S C ^ IWi ) ^ ^ S H d; ^ f£ Q c 9 V> T E = m « 
H+M(mod Q) ^rff-IS-rsr t*S-c#s 0 
§4.4 3»_hG>lbfN±« 
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SE»'*7*-* (N> K, p, q) 12. 2MS-C|ftMUfcJ;5^ ttlftl 

thbcDs*?*—? t LT, f£3- 3. 5 fl5fc y * h Lfc^^^^fc-f^ 7< — 

U PKC Sft^#14lrS^tfct©Tfc5, 

¥ X !7* D i7 Nlog 2 pbf'yh 

ft # -fb 7- + X h ' 7 D * N 1 o g 2 Q b* y h 

i> 

it mm* ° ( K N 2 • > m g g g 

"jTiiftg O (N 2 ) noil 

^ y -fc ^ ,^ jg 1 o g p q *t i 

N 1 o g 2 P r tf y h 

gjflgj K N 1 o g 2 q tf ^ h 

KjHfcSfKfi, 4KN2[H^Pli> KNtUW, pj#c£^£pq^£5l&li 
fU. 4 L'^: 2 SfiN T RU i:ov^TfiWT(?)9 1 ^ftft 5. 
¥ rf a y 2 N 1 o g , a y h 

nmt^-^r k - ^ D * 2N1 o g 2 q t* >y i- 
* 

/yfe->?jfc^ 2 g 1 

§4. 5 mrn±.<o^<D^m.-f^ ^ 

(i) g c d ( q> p ) = i -efcsi: «#j^n 

T RUfir ©S^jdSft < tti<^ HSR^tt, gcd (q, p) >l"CfeS4i 

3\ -t^ yr^^r-r^c m^mrnxn. P I q-efc5#^ ( exe r 
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c i s e) #-£ffc^y-fe-^elie=m (mo d p) SriffifcU NTRUWt 

(2) ^© f ^ p io j;D!q ^fe^t^e^ttl. : ^ ffi tl\ £V^5 

(f(D, pq ) = i-efc5^ -tL*s, fcSlRS'iifc f I^UTta-Cifeo 
«F*f^j*tf4i©«i39fcfc^*.«, f (X) +l*fcW:f (X) -1 
ftttitSiiiJ-etS. gcd (f(l), pq) =Utet5^ N^LT 
*»*»IKU pfcitfq&Bfc^S^i&PKov^ (Z/NZ) **c£>P<D 

^&*£<U fci^^N- 1 ifefcte (N-l) /2HLf;i^ fStf-f 
-<TcOf % ^^/^^^tt^ 0 fc£;ttf, r*U2, (N-l) 
"Cfo5 ("t"3fe^*>, N^S ophie Germai n3N&"Cfc5) *o fiflfc^ 
t-KT-fcSo ^©ip^ilC*^! 0 7*3 it* 1 6 7^*nSo 
§5 NTRU©M^t^a y x-T • /<7*—? 

[11, 12] ficpUSrSfiU j ett«*»«9"e>5C<\ ftS2 0 0^L3 0 0 

^™ Lt-oi ? tefa^mm&mmm (tit 

C2 P L g L <i> (K+l) <Q (4) 
g> ^ (VWmQm^mJj&J (##m eet-in-the -m i d d 1 e ) 
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) c2 = 0. 24*a«^9l-ftit5^, m^J^^m^^^i -5i-5&5 
q > 2 p d (4) 
( N 1_ £0 ^2- 

(d;d;N-2dJ (d!) 2 (N-2d)! 
T? dfe D L/fc*'o T a -4 0 SIKt 5. 

y * H S^fcliCttJft/Mf^flt'CfcS*^ gcd (p, q) £rWfc-t% -^iH 

ft q t^ftAtL^tl^r ^^WSC^HfcV\ #{^, q = 6 4 £«l 
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d 
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107 
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41.11 
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37 


107 
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41.11 
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38.98 
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29 
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43 


263 
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43.72 
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29 


263 
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43.72 
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(56) ^2 0 0 0-5 1 6 7 3 3 

'Amm : N 1 o g2 (q) V-yh 

: 2N 1 o g2 (p ) 
(N, d, p, q) = (1 6 7, 7, 3, 6 4) tt, ^CT^l 
0 0 2 t'y h*3itj?5 3 0 t> h^Ptt^i^fflSISr-g-tf^xA^^i" 

So 

§ 6 ||(7)PKCS <b©iti£ 
H«C5WH©JB^f-*^< Rivest, Shamir, Adelman 
(RSA [10] ) COv^T^ l"5t]E^I^<McE 1 i e c e [9] 

<tfc:X^< Goldreich, Goldwasser.Halevi (GGH 
[5]) cDS^O^T^&r'a^ v ' < o^^MliBt^-v^^^^^^^^^ 

■ Ate^BflSrCfcS) J;U»<-H5^5i:^9^McEl ieceO-> 

tf\ McEl i e c e ^fAtli:n^SIS'C»*5: 

U JI|£©&Wi, ^-i-^pItg^-r5S^h7y^ B KTT*fc5o McEl i e'c 

TRu©i^, ff^JAfi^lsltT^J-efc^, ACD, WIS]^t5 2 

o©ff^J©af^^#t, mod qi^mod p^©!J7f>f^^#t5 

■ffe^O^nS^ft) -Cfi, N T R U'^f A|:|±R S A'^f A ©*a^li 
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(57) ^2 0 00-5 1 6 7 3 3 

HttHBRfctt, McEl ieceW^fiLm. r*ltt, tffcfe©* 
e>T*>S 0 -n^fb-C NTRUI4, nT^-tt (1-ftfc>*>, ^PI) 
•WTO^fi, RSABf"§-v / ^^^> McEl i e c eBt^v-^X 
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* y -fe - 3? 4S 
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1-1 



x^o a p 

M f ( x ) = Ax « -f-B x- * £^5 0 wtf>#£\ f ' (x) =aAx«"i 
= ^B/aAT'4D^ (x ->0 + *5«tt/x^oo(Dt#^f (x) ^T'fcS: 
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